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Abstract 

We consider a generalisation of Ekert's entanglement-based quantum cryptographic 
protocol where qubits are replaced by quiVits (i.e., iV-dimensional systems). In order 
to study its robustness against optimal incoherent attacks, we derive the information 
gained by a potential eavesdropper during a cloning-based individual attack. In doing so, 
we generalize Cerf 's formalism for cloning machines and establish the form of the most 
general cloning machine that respects all the symmetries of the problem. We obtain an 
upper bound on the error rate that guarantees the confidentiality of quA^it generalisations 
of the Ekert's protocol for qubits. 



PACS numbers: 03.65.Ud.03.67.Dd.89.70.+c 



1 Introduction 



In quantum cryptographic protocols, the presence of an eavesdropper in the communication 
channel can be revealed through disturbances in the transmission of the message. To realize such 
protocols, it is necessary to encode the signal into quantum states that belong to non-compatible 
bases, as in the original protocol of Bennett and BrassardpQ. In 1991, Ekert suggested|2] a 
scheme in which the security of quantum cryptography is based on entanglement. In this 
scheme, one encrypts the key into the non-compatible qubit bases that maximize the violation 
of local realism. 

Recently it was shown that this violation is more pronounced for the case of entangled 
quAits|SlllllS] for N > 2. Moreover, the qutrit generalisation of Ekert's protocol is more robust 
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and safer than its qubit counterpart [HI Ej . This naturally serves as a significant motivation for 
studying the generalisation of Ekert's protocol where qubits are replaced by quA^its. 

There are several ways of realizing quA^its experimentally. One realization of quA^its, 
possibly the most straightforward one, exploits time-bins jH]. This approach has already been 
demonstrated for entangled photons up to eleven dimensions f9^. Another possibility is to utilize 
multiport-beamsplitters, and more specifically those that split the incoming single light beam 
into A^lin] outputs. Thus, an entanglement-based quantum cryptographic protocol based on 
quA^its instead of qubits can be realized with the current state-of-the-art quantum optical 
techniques. 

In this paper, we establish the generality of a class of eavesdropping attacks that are 
based on (state-dependent) quantum cloning machines [TT | \T2 \ IT8 | IT U IT5 t IT6] . We shall show 
that such attacks cannot be thwarted by Alice and Bob, the authorized users of the quan- 
tum cryptographic channel, because the disturbance due to the presence of the eavesdropper 
(Eve) perfectly mimics the correlations of an unbiased noise, at least for what concerns cor- 
relations between the encryption and decryption bases that characterize the A^ dimensional 
Ekert protocol. The security is shown to be higher for higher dimensional systems, a property 
that was already noted for several qutrit-based protocols in comparison to their qubit-based 
counterparts P III HZl CHI CHI ED] • 



2 The four quA^it bases that maximize the violation of 
local realism 

In the EkertQl protocol^, the four qubit bases chosen by Alice and Bob are the bases that 
maximize the violation of CHSH inequalities pT]. There exists a natural generalisation of this 
set of bases in the case of quA^its[4.. In analogy with the EkertQl bases that belong to a great 
circle on the Bloch sphere, these bases belong to a set of bases parametrized by a phase 0, 
that we shall from now on call the (p bases. These bases are related to the computational basis 
{|0),|l),...,|Ar-l)}: 

= -^S£oV'=(t'+^)|^),/ = 0,...,Ar- 1 (1) 

It has been shown that when local observers measure the correlations exhibited by the 
maximally entangled state |(^^) = Sill^ ® in the four bases that we obtain when 

= ^ ■ i{i = 0, 1, 2, 3), the degree of nonclassicality or violation of local realism that char- 
acterizes the correlations increases with the dimension A^OIHEl- It is also higher than the 
degree of nonclassicality allowed by Cirelson's theoremj22| for qubits, and higher than for a 
large class of other quA^it bases. Indeed, this can be shown by estimating the resistance of 
non-locality against noise|2l E], or by considering generalisations of the CHSH inequality to 
bipartite entangled quA^it states jH). From now on, we call the four quA^it bases that maximize 
the violation of local realism the optimal bases. 
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3 The A^- dimensional Entanglement based (A^-DEB) pro- 
tocol 



Let us now assume that the source emits the maximally entangled quA^it state \(f)%) ^"^^ that 
Alice and Bob share this entangled pair and perform measurements along one of the optimal 
bases described in the previous section. 

In order to show that these bases are pairwise perfectly correlated, it is useful to present 
an interesting property of the state \(f}%). Let us consider two bases: the ip basis chosen 
arbitrarily (with {i\il>j) = Uij), and its conjugate basis, the ifj* basis (with (^IV'*) = U*j). When 
Alice and Bob share the maximally entangled state and that Alice measures it in the 
^p* basis and Bob in the ifj basis, their results are perfectly correlated. To see this, we note 
that by virtue of the unitarity of the matrix Uij, \(f)'^) = -^J2k,r,m=o li'Dii^il^)'^ {"ipm) {"ipmlk) 
=^J:k,r,LomUMm)U*,^ = ^Et=ol^r)l^m)^w = :^J:to\rkm), whenever Alice 
projects the state into the conjugate basis ip*, she projects Bob's component into the -0 
basis and reciprocally. 

Moreover, the state |(/)^) can be rewritten as |(/)^) = -^{Yli!=^^i\i*^) ® where 

= -^E£o^e-^(t'+^)|fc)(/ : 0, N-1) (2) 

Therefore, when Bob performs a measurement in the basis (l^^)) and Alice in its conjugate 
basis (|fcj)), their results are perfectly correlated. Now, the four optimal bases are pairwise 
conjugate and hence perfectly correlated as well. To show the perfect correlation, we note that 
for the phase that appears in Eq. Q, -k{^l + (l)) = k{^{N - I - j) - (p + j^) mod 27r where 
j is an arbitrary integer number. Now, N — I — j varies from to — 1 ( mod A^) when / varies 
from to A^ — 1 which shows that the </>* basis is the same as the (p' basis (with (f)'=—(p + j^). It 
is easy to check that, thanks to an appropriate choice of j, the bases associated to even values 
of i (i = 0, 2, 0j = ■ i) are preserved under phase conjugation, while the bases associated to 
odd values of i (i = 1, 3) are interchanged. The four optimal bases are thus pairwise maximally 
correlated. 

In a natural generalisation of the Ekert91 protocol for quA^its, denoted as the A^-DEB 
protocol (i.e. the A^-dimensional entanglement based protocol) in analogy with the notation 
adopted in Ref.[7] for the case A^ = 3, Alice and Bob share the entangled state and choose 
their measurement basis at random among one of the four optimal quA^it bases (according 
to the statistical distribution that they consider to be optimal). Because of the existence of 
perfect correlations between the conjugate bases, a fraction of the measurement results can be 
used in order to establish a deterministic cryptographic key. The rest of the data, for which 
Alice's and Bob's bases are not perfectly correlated, can be used in principle in order to detect 
the presence of an eavesdropper for example with the help of generalized CHSH inequalities [Sj. 
Let us now study the safety of this protocol against optimal incoherent attacks. 
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4 Individual attacks and optimal cloning machines 



We assume from now on that the noise that characterizes the transmission (this includes dark 
counts in the detectors, misahgnments of Ahce and Bob's bases, transmission losses and so on) 
is unbiased (this is a very general assumption). Under such conditions, the state shared by 
Alice and Bob must mimic the correlations that is observed when they share a state that has 
the following form: 

PrAFn) = (1 - F^)\cf>%)n,A{^%\R,A + F^p-^y^, (3) 

where p^''^^ = -^Ir^a, and the positive parameter < 1 determines the "noise fraction" 
within the full state. In the following, we make the conservative hypothesis that all the errors of 
transmission could be due to the presence of an eavesdropper who possesses a perfect (noiseless) 
technology, controls the line of transmission and lets her state(s) \(f)%)R^A interact with the one 
originally shared by Alice and Bob and an auxiliary system (or probe). In principle. Eve is 
free to use any interaction between one or several quA^it pairs (originally prepared in the state 
\4'n)r,a) and an auxiliary system of her choice. Eve could keep this auxiliary system isolated and 
unperturbed during an arbitrary long period of time. On hearing the public discussion between 
Alice and Bob, she performs the measurement of her choice on her system. In principle she 
could let her auxiliary system interact with a series of successive signals and/or carry out her 
measurement on a series of auxiliary systems. We limit ourselves to the situation where she 
couples each signal individually to an auxiliary system (individual or incoherent attacks). It 
could happen that coherent attacks (so-called joint or collective attacks, for a review, see e.g. 
|23j ) are more dangerous but presently nobody knows whether this is the case. 

Let us assume that initially Alice and Bob share the state \(p%) and that during an individ- 
ual attack. Eve lets this state interact with her probe (which also belongs to a A^^-dimensional 
Hilbert spacef^ which can be seen as the "mirror space" of Alice and Bob's A^^-dimensional 
Hilbert space). Then, the most general cloning state \'^)r^a,b,c where the labels R,A,B,C 
are respectively associated to the reference R (Alice), the two output clones {A for Bob and 
B for Eve), and to the (A^-dimensional) cloning machine (C) is the element of a A^^ dimen- 
sional Hilbert space. Our task is to optimize this state in such a way that Eve maximizes her 
information and minimizes the disturbance on the information exchanged between Alice and 
Bob. Moreover, as the real disturbance along a transmission line is assumed to be unbiased, 
the disturbance induced by the presence of Eve must mimic an isotropic disturbance so to say, 
it may not depend (1) on the state that Alice and Bob measure when they measure in perfectly 
correlated (conjugate) bases, and also (2) on which pair of such bases is selected; finally (3) it 
must also mimic the correlations between the non-conjugate bases that would be observed in 
the presence of real (unbiased) noise. 

4.1 Invariance under relabelings of the detectors and Cerf states 

Clearly the complexity of the problem to solve increases as the fourth power of the dimension 
A^. It is thus necessary to simplify the treatment as much as possible by taking account of 
the intrinsic symmetries of the problem. According to the notation introduced in the previous 
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section, let us consider an arbitrary basis, the basis associated to Bob, and its conjugate 
basis, the 0* basis, associated to Ahce. A fundamental symmetry characterizes such bases: the 
states of the (0*) basis are permuted if we vary the phase (f) by any multiple of It is easy 
to show that any such permutation is generated by C, the generator of the cyclic permutations 
that shifts each label of the states of the (0*) basis by unity (Z ^ Z + 1 ( mod A^)). When 
the condition (1) is fulfilled, so to say when the error rate does not depend on the label Z, it is 
natural to impose this invariance at the level of the cloning state. In order to do so, it is useful 
to introduce the so-called Bell states. The A^^ generalized Bell states are defined as follows[7]: 

N-l 

\Bt,n)RA = N-'/' Y: e''''^'-/''^mR\i^k+m)A (4) 

k=0 

with m and n {0 < m,n < N — 1) labeling these Bell states. Obviously they are eigenstates 
under the generator of cyclic permutations I I + 1 for the eigenvalue e-2'r«("/A^) ^ Moreover 
they form an orthonormal basis of the A^ dimensional space spanned by the product states 

\rk)R\^i)A = o,...,A^-i). 

Note that all the Bell states are maximally entangled and that \4>%) = \Bqq). Let us 
consider the fraction of the signal that is measured by Alice in the ip basis and by Bob in 
its conjugate basis (the ip* basis). As these are perfectly correlated bases, this signal is not 
discarded and it will be used afterwards, during the reconciliation protocol, to establish a fresh 
cryptographic key. At this level, when Alice and Bob reveal publicly their choices of bases. Eve 
will measure her ancilla in the basis that she deems to be optimal Eve is free to redefine 
this basis thanks to an arbitrary unitary transformation according to her convenience. Taking 
account of the dual nature of the "mirror" space assigned to Eve, it is natural that Eve fixes 
this unitary transformation in such a way that she measures her copy in the same basis as Bob 
(the i/j basis) and the cloning state in the conjugate basis (the i/j* basis). Expressed in these 
bases, the most general state \'^)r,a,b,c that is invariant under cyclic permutations of the labels 
assigned to the detectors has then (up to an arbitrary redefinition of Eve's basis) the following 
form: 

7V-1 

\'^)r,A,B,C = X! (^m,m' ,n\B'j^* ,n) R,A\Bm' -n*) B,C (5) 
m,m' ,n=l 

where by definition 

Af-l 
fc=0 

Note that we introduced at this level two apparently different definitions of the Bell states. 
Both can be re-expressed according to the synthetic expression: 

N-l 
fc=0 

In the computational basis (where \k) = \k*)), these definitions coincide with the usual definition jl3j. 
Indeed, our approach constitutes a covariant generalisation of Cerf's formalism for cloning 
machines JH]- At this level, the complexity of the problem to solve is only in N^, because we 
projected the state \'^)r^a,b,c onto the set of states that remains invariant under a shift unity 
of the labels assigned to the basis states. We shall now show that it is still possible to reduce 
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the complexity of the problem if we consider the question of optimality. Prior to this, let us 
introduce the following definitions: 

Definition 1: The pure state \^)r^a,b,c is a Cerf state iff, for a given basis (say the ifj basis), 

N-1 

|^)i?,A,B,C = X! (''ra,n\Bti* R,A\Bm-n*) B,C (8) 
m,n=l 

Note that then TrB,c\^)R,A,B,c{^\R,A,B,c is diagonal in the Bell basis and 
TrR^A\'^) r,a,b,c{^\r,a,b,c is diagonal in the Bell basis |i?^_„.)B,c- Beside, normalization im- 
poses that Em^^ lOm.nP = 1- 

Definition 2: 

A (pure) Cerf state is optimal among the Cerf states (for a given quantum cryptographic 
protocol) iff, for the same mutual information between Alice and Bob, the mutual information 
between Alice and Eve corresponding to this state is superior or equal to the one corresponding 
to any other (pure) Cerf state or to any mixture of them. 

Theorem: 

-Let us assume that an attack is characterized by a state \^)r,a,b,c that is invariant under 
cyclic permutations of the labels of Alice and Bob's basis states (in the '0* and ij) bases). 

-If the optimal Cerf state exists, then it is also optimal among all possible states \^)r^a,b,c- 

Proof: 

We have shown that the most general state \^)r,a,b,c that is invariant under cyclic per- 
mutations of the labels of the optimal bases must necessarily fulfill Eq. (jSj) which does not 
necessarily imply that it is a Cerf state. Nevertheless, by virtue of Eq. ((7j), we have that 



mRABc{MRABC = N'^Y.'''\ - ~,.,,rj ^a^m'na*- , e^(WA^)((fc-0— (^"0-) . (9) 

I /n,^,iD,o\ in,^,iD,o ^m,m' ,n,m,m' ,n,k,l,k,l=0 '"i"' m,m' ,n ^ ' 

The mutual informations must be estimated on the non-discarded signal that is measured in 
the basis by Alice and in the basis by Bob, while Eve measures product states of the type 

b\'^v) c ■ Therefore only the diagonal coefficients that appear in the expression of the density 
matrix (Eq. Q) are relevant. It is easy to check that for such coefficients m — m! = rh — m', so 
that \'^)r,a,b,c{'^\r,a,b,c is equivalent to a reduced density matrix Prabc defined as follows: 

„red _ x^N-l ^ ^* I rV' \ I rV' \ / R^ I / R'/' I 

PR,A,B,C ~ 2^mA,n,m,h=0"'rn,rn'=m+i,nU'^^^,^^_^_^f^ \-^m* ,n/ R,A\^m+i,-n* / B,C\-Dffi* n\R^A\-D^^i_n* \B,C 

which in turn corresponds to the following mixture: 

p'Ab,c = P^PR:l%,c, where 

N-1 N-1 

BiPR^A,B,C ~ X/ ^m,m'=m+i,n\B^*^n)R,A\Bm+i-n*)B,C- X/ ^m,rn'=m+i,n^'^rh* ,h\RA(Bm+i,-h*\B,C 
m,n=0 m,n=0 

(10) 
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and Pi = Em,nLo Wm,m'=m+i,n\^- Pr^a b,c projector onto the state \'^)r^a,b,c^ with 

^ N-1 

l^)i?,A,B,C ~ rp- X/ ^m,m'=m+i,n\B^* n) R,A\B^j^i _n*) B,C ■ (H) 
V * m,n=0 

Everything happens as if the above state was chosen with probabihty Pi without that 
Eve is able to control this choice or even to get informed about it. Her information is thus 
certainly less than the information that she would get if she was informed about this choice. 
Beside, once the choice of a particular \'^)^iiABC realized, the mutual information between 
Eve and Alice is invariant when Eve chooses to re-label her detectors, in particular if she re- 
labels them according to the rule lipi) sl'ipi+m+i) c li'i) sli'i+m} which sends |-B^+j _„*)b,c onto 
\Bm-n*)B,c- Note that this re-labeling does not influence at all the statistical distribution of 
Alice and Bob's results and their mutual information. In conclusion. Eve's information is in the 
best case equivalent to the information that she would get by realizing the state I'^Yrabc — 

Y.ni7n=o 0'm,m'=m+i,n\Bt*,n)R,A\Bt-n*)B,c wlth probability Pj, and being informed about the 
nature of this choice. This corresponds to a mixture of Cerf states, which ends the proof: when 
optimal Cerf state exist(s), then, if a state \'^)r,a,b,c belongs to the class of states defined in 
Eq. © and is optimal it is necessarily equal to this (one of these) Cerf state(s). 

This theorem shows that it is sufficient to optimize the cloning machines described by a 
Cerf state which again reduces the complexity of the problem: such a state is now described, 
according to Eq. (jSJ by parameters am,n instead of the parameters am,m',n- Note that 
in Cerf's approach, Eq. (jSJ was considered to be an ansatz 13j the previous theorem shows 
that its generality can be established on the basis of more general assumptions. The property 
that was encapsulated in the previous theorem expresses a deep property of the Bell states. 
Actually, from Eve's perspective, everything happens as if different families of Bell states were 
separated by a classical super- select ion rule. It helps to understand why, when the optimal 
state is pure it is sufficient to limit oneself to the quest of the optimal Cerf state. 



4.2 Invariance under the choice of the optimal basis 

At this level we did not exploit all the symmetries of the problem, we only made use of the fact 
that inside a given pair of perfectly correlated (conjugate) bases, the labeling of the detectors is 
defined up to a cyclic permutation. Another symmetry of the problem that we did not exploit 
yet is the following: according to the condition (2), all pairs of perfectly correlated bases must 
also be treated on equal footing. Therefore it is natural to impose that the optimal Cerf state 
associated to the A^-DEB protocol fulfills the following constraints 



A,B,C 



N-1 

m,n=l 
N-1 



n I ^m* ,nl R,A \ ^m,—n* I B, 



0=0 



C 



N-1 

m,n=l 

N-1 



25 



27r 

4iV \ I JD^ AN , 

D^* „ )RM^m-n']B,C 



Cl'm,n\^m*,n ) R,A\^m-n* ) B,C — 2^ C'm,n\^m",n ) R,A\^m-n* ) B,C 
m,n=l m,n=l 



(12) 
(13) 
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The treatment of this type of constraint is developed in appendix. The result is extremely 

^ 27rp ^ 27rg 

simple: whenever {B^,j'^'^\Bf.*^i*'^) ^ (where p,q,= 0,1,2,3), then Uij = ttk^i- Actually 
these results were already used in for the treatment of the qutrit case but have not been 
published yet. These constraints express the necessary and sufficient conditions for which the 
Cerf state (Eq. (jH))) that characterizes the cloning machine possesses biorthogonal Schmidt 
decompositions in the Bell bases (Eq. ((7j)) associated to the four optimal bases simultaneously. 
By a straightforward computation we get that 

p,q=o 

gi(-p(02-0i)+<?((02-</.i)+2f (fc-i))) C]_4) 



In particular, we have that when j = I = 0, 



I D01 I ■r><i>2 \ 
\-Oi*,0l-°fc*,0/ 



5, 



which means that B% n 



Bf* (j\/(j). When j = I ^ 0, \{Bpj\B^^j) \ reaches the extremal values 1 or only when — 02 is 
an integer multiple of This is due to the fact that for such values the basis states |Z^;^) are 
equivalent to the states up to a cyclic permutation of the labels of the basis states and 
we showed in a previous section that the Bell states are eigenstates under such permutations. 
Otherwise, for intermediate values of these in-products are never equal to zero. Therefore 
the Cerf state \'^)r^a,b,c that is invariant for at least two distinct values of ( mod ^) is 
characterized by the NxN matrix „ that obeys the following equations: 



/ 



V 


yi 


2/2 • 


• yN^ 


-1 


Xi 


yi 


2/2 ■ 


■ yN- 


-1 


X2 


yi 


2/2 • 


■ yN- 


-1 



y xn~i 2/1 2/2 



(15) 



2/7V-1 / 



The (normalized) matrix am,n still contains 2{N — 1) independent parameters. This shows that 
it is not enough to impose the invariance of the state \'^)r,a,b,c under cyclic permutations 
of the basis states or under changes of bases in order to fix all the parameters of the cloning 
state. We shall do this by optimizing the information gained by Eve. We shall impose that, 
in virtue of the "mirror" property of the cloning transformation, when the detector associated 
to the projector onto the state \k^*) E\lct>) e' fires, the probability of the inference that Alice 
and Bob's state is |/C(^*)a|Z(/))s is maximal. It is easy to check that the probability that Alice 
and Bob's state is \k'j^*) aII^) b conditioned on the observation by Eve of the state \k^*)E\l(j,)E' 



is equal to S, 



E^-,' ai.k,nexp{t'^{k' - k)n)\' 



. Let us first assume that the fidelity and 

the disturbances are fixed, (including the coefficients Ojo {i = 0,...N — 1)). These parameters 
will be varied them later. Using the method of Lagrange's multipliers with the constraint 



that 



N-l 
j=0 



a. 



y I 



is constant, and maximizing the function | 



N-l 
j=0 



aij 



^ under the variations of 

1 „ v^Af-l 



o^j.ii Q^j,2i ■■■0'i,N-i, we get that the — 1 dimensional vector {J2j'=o^ (^ij^H^=Q C'ij^ ■■■^J2j'=o^ <^ij) is 
parallel to the — 1 dimensional vector 



that corresponds to a maximum is the following: 



.,ai,iv_i). The solution of these constraints 
0.1,1 = ai,2 = ... = Oi,iv-i and the phase 
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of these complex numbers is the same as the phase of ai^. Now, as {ai^i,ai^2, ■■■,o,i,N-i) = 
{ao,i,ao,2, ■■■,ao,N-i) = {yi,y2, ■■■,yN-i) and (ao,o, ai,o, aAf-i,o) = {v,Xi, ...,xn-i) in virtue of 
Eq. (fT^ . we get that 1/1 = 2/2 = ••• = yw-i, and all the coefficients Xi and yi have the same 
phase as v. We can without loss of generality assume that this phase is zero. Moreover, we 
must impose that all disturbances are equal; otherwise. Eve's presence could be detected easily 
by Alice and Bob. Indeed, at this level all the states of a same (p basis are not treated on 
the same footing. This can be checked for instance by estimating the disturbances. There are 
N-1 possible errors when copying the basis state \k^) Depending on it being transformed into 
\{k + mod A^, with i = 1, ...,N — 1). Therefore, we define N-1 disturbances Di, D2and 
Dm -I corresponding to these N-1 errors. By a straightforward but lengthy computation, we 
get that the zth disturbance is equal to \xi\^ + SjLV biP (j — 1' N — 1) which, in general, 
is not independent on the label i. If we impose that the disturbances are independent of the 
label z, we get xi = X2 = ... = xn-i and the matrix amn contains only real positive coefficients. 
Taking account of Eq. |T3|). we obtain the final form of the matrix am,n'- 



/ 


V 


y 


y ■ 






X 


y 


y ■ 


• y 




X 


y 


y ■ 


■ y 


V 


X 


y 


y ■ 


■ yJ 



Note that it is sufficient that the cloning state \'^)r^a,b,c is invariant for two distinct values 
of (p in order that it is invariant for all values of (p, so to say that it acts identically on each 
state of the bases. Such a doner is thus phase-covariant, in analogy with the qubitpi] and 
qutrit cases [7]. 

We determined numerically the values of v, x and y for which Eve's information is maximal 
while the fidelity of Bob's clone is fixed. Letting vary this fidelity, we determined the error rate 
that corresponds to the crossing point of Bob and Eve's mutual information relative to Alice's 
data {Iab = Iae)- According to Csiszar and Korner theorem |23] Alice and Bob can distill a 
secure cryptographic key if the mutual information between Alice and Bob Iab is larger than 
the mutual information between Alice and Eve Iae, i-e., Iab > Iae- If we restrict ourselves 
to one-way communication on the classical channel, this actually is also a necessary condition. 
Consequently, the quantum cryptographic protocol above ceases to generate secret key bits 
precisely at the point where Eve's information matches Bob's information. 

The threshold fidelities below which the security of the protocol is no longer guaranteed 
are listed in function of the dimension in the table ^ These values are the exactly the same 
values as those obtained from a higher dimensional generalization of Ref. [211 • Note that in the 
qubit (A^=2) and qutrit (A=3) cases, we recover the properties (optimal fidelity, upper bound 
on the error rate and so on) derived in the literature following Cerf 's approachjl7t 1771 El or 
more general approaches [2|1I2H1 El- The threshold fidelities that we obtained are lower than the 
corresponding values in the case of symmetric doners, which were derived in Ref. |29j. This is 
due to the fact that in our approach Eve considers the full information contained in the clone (B) 
and in the ancilla (C). In the large N limit, it is easy to show that Iae = ^ — Fa and Iab = Fa- 
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AT 




2 


0.853553 


3 


0.775276 


4 


0.734178 


5 


0.708043 


b 


0.589788 


7 


u.u ( uzou 


8 


0.665708 


9 


0.657267 


10 


0.650319 


oo 


0.5 



Table 1: Fidelity for dimension 2 < < 10 

Thus, in this limit, we find that the doner converges to the universal (isotropic) doner while 
the fidelity goes to fifty percent. The tolerable error rate has also been shown recently Ref. 
to tend to fifty percent with the dimension of quA^its going to infinity (with A^ being a prime 
number) in another prepare-and-measure scheme. It seems that this asymptotic behaviour is 
quite general. 

4.3 Correlations between non-conjugate bases 

The unbiased noise that appears in Eq. Q is characterized by a density matrix that is propor- 
tional to the identity Ir^a- Now, Ir,a= h-lR= Eilo^ \i>*)R{'^i\R-J2j'jo^ l^i)A(^jU where the 
ijj and the -0 bases can be chosen arbitrarily. This arbitrariness suggests some invariance of 
the noise under local changes of basis. In particular, when Eve replaces the signal by a clone, 
this invariance must be respected. According to the condition (3), this clone must mimic the 
correlations between the non- fully correlated (non-conjugate) bases that would be observed in 
the presence of real, unbiased, noise. We shall now show that this is well the case. In order 
to do so, let us consider the reduced cloning state pra = Trs^cl"^) r,a,b,c{'^\r,a,b,c obtained 
after averaging over Eve's degrees of freedom; according to Eqs. (|1I2I4I8I16|) . and thanks to the 
identities 

1^0** ,o) = 10^), J:Zzln=o\Bt,n)R,A{Bt,-n\R,A = ^A, and ^^"^1 e-^-CC^'On/A^) = NA,i, 
we get: 

N-l N-l 

PR,A = 'f^^|-So*,o)iJ,A(-Bo*,olH,A + X! \Bm*fl)R,A{Bm*,o\R,A )R,A{Bm*-n\R,A 

m=l m=l,n=0 

N-l N-l 

= (f^ - X^)|0^)R,A(0^|iJ,A + {X^ - y^) J2 \Bt*,o)R,A{Bt',o\R,A + J2 \BL,n)R,A{Bt*,-n\R,A 

m=0 m=0,n=0 

1 N-l 

= {v' - x')\<P%)r,a{<P%\r,a + N.{x' - y')- J2 \n)R\n)A{n\R{n\A + .y' p],°Xi^7) 

n=0 

In comparison to Eq. (jS)) a new factor weighted by N.{x^ — y^) appears in the previous 
expression. It is a mixture of projectors on products of the states of the computational basis 
\n)R\n)A- 
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For what concerns measurements performed by Alice and Bob in the optimal bases (that 
they are conjugate or not), any such product has the same statistical properties as the unbiased 
noise p^^X^ = -^Ir^a- The deep reason for this property is that the in-product between any 
state of the computational basis and any (f) state is in modulus squared equal to in other 
words, both bases are mutually unbiased. Henceforth, the modulus squared of {n\ji{n\A\k*^^)\l(j,^) 
is equal to whatever the values of the labels k and / could be. 



5 Conclusions 



The EkertQl protocol P| and its quA^it extension, the A^-DEB protocol which is analyzed in the 
present paper, involve encryption bases for which the violation of local realism is maximal. If 
Alice and Bob measure their member of a maximally-entangled quA^it pair in two "conjugate" 
bases, this gives rise to perfect correlations. After measurement is performed on each member 
of a sequence of maximally-entangled quA^it pairs, Alice and Bob can reveal on a public channel 
what were their respective choices of basis and identify which quA^it was correctly distributed, 
from which they will make the key. They can use the rest of the data in order to check that it 
does not admit a local realistic simulation. For instance they can check that their correlations 
violate some generalized Bell or CHSH inequalities [21 . More generally, they can check that the 
correlations between their results (that they are perfectly correlated or not are the same as 
the results that they expect in the presence of unbiased noise. Note that the optimal bases do 
not allow them to differentiate a fully unbiased noise (described by a fully incoherent reduced 
density matrix proportional to the unity matrix) from a "colored" noise that would contain 
projectors (with arbitrary weights) on product states of the computational basis. As shown 
at the end of the last section, this is due to the fact that all the optimal bases are mutually 
unbiased relatively to the computational basis. This explains why the phase-covariant attacks 
are more dangerous than the universal (state-independent) attacks. For instance, the maximal 
admissible error rate (when attacks based on state-dependent doners are considered) was shown 
to be equal to = 1 - Fa = 1 - (| + ^) ~ 14.64% for the 2-DEB protocol (or EkertQl 
qubit protocol) |2ll EH Elj and to 22.47 % for the 3-DEB protocol Ej. The corresponding 
rates, if we restrict ourselves to state-independent doners were shown in Ref.^^ to be 
respectively equal to 15.64% and 22.67%. These results were derived for a slightly asymmetric 
state-independent doner [T7] that clones all the states with the same fidelity. Universal 
attacks correspond to protocols in which Alice and Bob have the physical possibility to measure 
(distinguish) experimentally any coefficient of the reduced density matrix which is not the case 
here. This is the price to pay, but, at the same time, as the resistance of the violation of local 
realism against noise is maximal when the maximally-entangled quA^it pair is measured in the 
optimal quA^it bases discussed hereOE], the A^-DEB protocol is optimal from the point of view 
of the survival of non-classical correlations in a noisy environment. 

Actually, it has been shown that the violation of a Bell inequality extended to quA^its is 
possible, as long as the "visibility" of the two-quA^its interference exceeds a threshhold value Vthr 
given by the equation = ES'"'(l-]|!T)( ,,^2(^(4l+i)/4jv) - .^n2(^(4fc+3)/4jv) )- The visibility 

mentioned above is directly related to the threshold fraction of unbiased noise, (1 — Vthr{N)), 
which has to be admixed to the maximally entangled state in order to erase the non-classical 
character of the correlations, and therefore is a measure of robustness of non-classicality (see 
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also [3 El)- This means that the non-existence of a local realistic model of the correlations 
is guaranteed if the fidelity Fthr that characterizes the communication channel between Alice 
and Bob, (detectors included, so l-Ffhr is the effective error rate in the transmission) is larger 
than ^ X Vthr{N) + ^. For instance, for = 2,3,4,5 and 10, 1-Fthr is equal to 14.64 %, 
20.26 %, 23.21 %, 25.03 % and 28.77 % respectively. On the other hand, the A^-DEB protocol 
is secure against a cloning-based individual attack, if F = 1 — > Fa = Fthr (see table). 
If we compare the previous values of 1-Fthr with the corresponding values of 1-Fa (with Fa 
given in the table), it is easy to check that when a violation of local realism occurs, the security 
of the A^-DEB protocol against individual attacks is automatically guaranteed. Therefore, the 
violation of Bell inequalities is a sufficient condition for security, as it implies that Bob's fidelity 
is higher than the security threshold. For qubits the sufficient condition {Fa > 0.8436) is also 
necessary ([23)- 

In addition, the violation of Bell inequalities guarantees that the A^-DEB protocol is secure 
against so-called Trojan horse attacks during which the eavesdropper would control the whole 
transmission line and replace the signal by a fake, predetermined local-variable dependent, 
signal that mimics the quantum correlations (see Ref.0 and references therein). All the pro- 
tocols in which no entanglement is present (such as BB84PP, the 6-state qubit protocol j2Hl CHI, 
or the 12-state qutrit protocol 18J) admit a local realistic model, so that they are not secure 
against Trojan horse attacks, although, according to the results of Ref.[T7j they are slightly 
more resistant against noise than the A^-DEB protocol. 

As we have already noted, our results confirm the results that can be found in the literature 
relatively to the security of the 2-DEB and 3-DEB protocols, but at the same time our results 
are confirmed by the corresponding results in the case that they were derived under constraints 
more general than the ones that we postulated. Note that in order to find an expression for the 
cloning state that is valid for arbitrary dimension, it is impossible presently to avoid some extra- 
assumptions, for instance that the optimal cloning state is pure, A^^ dimensional, symmetric 
under cyclic permutations of the labels of the optimal bases and so on. These assumptions are 
very reasonable anyhow. If we would try to avoid any extra-constraint, the complexity of the 
problem would increase with the dimension A^ and we could not find a solution for all values of 
A^. Note also that the security of quantum cryptographic protocols against incoherent attacks 
was never clearly established, simply because the problem is too complicate to tackle. 

In summary, we have established the generality of Cerf's approach of quantum state- 
dependent cloning machines under fairly general assumptions. We have shown that the ac- 
ceptable error rate of the A^-DEB protocol turns out to increase with the dimension A^. Our 
analysis confirms a seemingly general property that the robustness against noise of quA^it 
schemes increases with the dimensionality A^. 
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6 Appendix: Invariance of the cloning state. 

Let us consider a reference basis, the ip basis, its conjugate basis the ijj* basis, another basis, 
the ip basis and its conjugate basis the ip* basis (with = Uij and = Uij). Let us 

assume that during the realisation of a quantum cryptographic protocol, Alice and Bob share 
the maximally entangled state 10^) (|i?o,o)) and that Alice measures it either in the basis 
or in the ip* basis (with (ilip*) = U*j and {ili^j) = U*j). according to the proof given in the 
section 2, she projects Bob's component onto either the ip or the -0 basis. If we require that the 
cloning machine is invariant in both bases, the joint (Cerf) state of the reference R, the two 
output clones (^4 and B), and the (A^-dimensional) cloning machine C (Eq. (jH))) must fulfill the 
following condition: 

N~l N-1 

Om,n \Bm'',n) R,A\Bm-n*)B,C = X! \Bm* ,n) R,A\Bm-n'') B,C (18) 

m,n=0 m,n=0 



As the A^^ Bm,n states form an orthonormal basis, we can project the righthand side of the 

previous equality onto them, which gives: Y.m7n=0(^m,n\Bm*,n)RA\Bm-n-)B,C = J2m7n,m',n',m",n"=0 
\Bm'-,n')R,A R,A{Bm'* ^n'lBm* ,n) R,A \Bm" -n"*) B,C B,c{Bm" -n"*\Bm-n*) B,C 



Denoting Vi^j^k,i the in-product {Bi,jBk*,i), we get: Em,n!fe,«=o am,nS{m,n),ik,i)\Bm*,n)R,A\Bk-i*)B 



c 
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^m,n,m' ,n' ,m" ,n"=0 ^1^,71 \Bm"- ,n') R,AVm' ,n' ,m,n \Bm" ,-n"*) 3,0^-^" ,n" ,m,n ~^m,n,i,j,k,l=0^ij^{i,j),ii' 

Vm,n,i,j Vk,i,i',j' \Bm* ,n) R,A\Bk-i*) B,c- Thanks to the orthonormality of the Bell bases, this con- 
straint can be expressed as a matrix relation of the form VA = AV where V and A are N'^xN'^ 
matrices defined as follows: Vij-k,i = {Bi*j\Bk*^i) and Aij-k,i = 0'i,j5{ij),{k,i)- Such a system of 
linear equations is extremely simple to solve: if Vij-k,i 7^ 0, then j = ak,i. The procedure to 
follow in order to build a cloning machine that is invariant in the ■0 basis and the i/j basis is thus 
straightforward: compute the A^"^ in-products Vij-k,i = {Bi*j\Bk*^i) {i,j,k,l = 0,...,N — 1); if 
7^ 0, then ttij = ak^i- The solutions am,n of this set of equations define the most general 
Cerf state (Eq. (jH}) that is invariant in the two bases. 
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